If for some reason you don't like a mail originating from mynetworks
to count as authenticated, just move the permit_mynetworks up to the
first position in the smtpd_sender_restrictions (referring to the
example in the amavisd-new-docs.html#dkim-postfix-dual-path section).

Btw, if using amavisd as a pre-queue content filter (smtpd_proxy_filter),
things can get more complicated, as it is prudent to DKIM-sign mail
late in the mail processing, after an MTA does its job on mail
sanitation (adding missing header fields like Date and Message-ID,
or QP-encoding nonencoded 8-bit mail parts), and canonicalizations
(like adjusting domains in a From header field). To accomplish
this, a pre-queue filter should only do its contents filtering
and DKIM signature validation, but no signing. A clean mail
which needs to be signed can at the end be fed to a dedicated
content filtering port where amavisd would only do its DKIM
signing, with all other contents checking disabled.